Identity access management systems and methods with enforceable compliance
Systems and methods for enforcing compliance-program conformity during authorization-token generation are presented. Applications may be registered with an identity and access management (IAM) system. The registration of the application may include whether the application is subject to one or more compliance program(s). When an authorization token is requested from the IAM system, the IAM system may (a) determine the set of authorization information needed in the token, and (b) determine whether the application is subject to a compliance program. The IAM system may then check an approval source of record to determine whether the user was legitimately approved for the required authorization prior to granting an authorization token. If there is a mismatch between the approval source of record and the authorization information associated with the user identity, then the mismatch may cause certain mitigation actions to be performed.
1 . An identity and access management system comprising:
at least one processor; and
memory comprising instructions that, when executed by the at least one processor, cause the at least one processor to:
receive a request for an authorization token to authorize at least one function associated with a target application;
determine identity information from the request;
determine authorization information associated with the identity information;
determine that the target application is subject to a compliance program;
determine, based on determining that the target application is subject to the compliance program, whether an approval record associated with the authorization information satisfies the compliance program;
when the approval record is determined to satisfy the compliance program, generate the authorization token according to the authorization information, wherein the authorization token includes an attribute indicating that the approval record satisfies the compliance program; and
transmit the authorization token in response to the request.
2 . The system of claim 1 , wherein the instructions further cause the at least one processor to:
when no approval record is determined to satisfy the compliance program or the approval record is determined to be expired, transmit a request to confirm the authorization information; and
upon receiving confirmation of the authorization information:
generate and store a new approval record;
generate the authorization token according to the authorization information; and
transmit the authorization token in response to the request.
3 . The system of claim 1 , wherein the instructions further cause the at least one processor to:
when no approval record is determined to satisfy the compliance program, transmit a request to confirm the authorization information; and
upon failure to receive confirmation of the authorization information, perform an additional mitigation action, wherein the additional mitigation action comprises one of:
generate an alert;
generate the authorization token according to the authorization information and with an attribute indicating that the approval record is not compliant; or
direct a device making the request to a non-production instance of the target application.
4 . The system of claim 1 , wherein the identity information corresponds to a user, wherein the authorization information includes group membership for the user in a first group, and the approval record comprises a ticketed event by which the user was added to the first group.
5 . The system of claim 4 , wherein determining whether the approval record associated with the authorization information satisfies the compliance program comprises:
determining an expiration time for the approval record based on the compliance program; and
determining whether the approval record has expired for the compliance program.
6 . The system of claim 5 , wherein the instructions further cause the at least one processor to:
determine that the target application is also subject to a second compliance program;
determine a second expiration time for the approval record based on the second compliance program; and
determine whether the approval record has expired for the second compliance program.
7 . The system of claim 1 , wherein the instructions further cause the at least one processor to:
receive a registration request for the target application, including an indication of the compliance program; and
store an association between the target application and the compliance program.
8 . The system of claim 1 , wherein the instructions further cause the at least one processor to:
receive a compliance program profile for the compliance program; and
store an association between the compliance program profile and the target application.
9 . The system of claim 1 , wherein the request for the authorization token is received from a first application, separate from the target application, to use an application programming interface (API) function of the target application.
10 . A method, comprising:
receiving a request for an authorization token to authorize at least one function associated with a target application;
determining identity information from the request;
determining authorization information associated with the identity information;
determining that the target application is subject to a compliance program;
determining, based on determining that the target application is subject to the compliance program, whether an approval record associated with the authorization information satisfies the compliance program;
when the approval record is determined to satisfy the compliance program, generating the authorization token according to the authorization information, wherein the authorization token includes an attribute indicating that the approval record satisfies the compliance program; and
transmitting the authorization token in response to the request.
11 . The method of claim 10 , further comprising:
when no approval record is determined to satisfy the compliance program or the approval record is determined to be expired, transmitting a request to confirm the authorization information; and
upon receiving confirmation of the authorization information:
generating and store a new approval record;
generating the authorization token according to the authorization information; and
transmitting the authorization token in response to the request.
12 . The method of claim 10 , further comprising:
when no approval record is determined to satisfy the compliance program, transmitting a request to confirm the authorization information; and
upon failure to receive confirmation of the authorization information, performing an additional mitigation action, wherein the additional mitigation action comprises one of:
generating an alert;
generating the authorization token according to the authorization information and with an attribute indicating that the approval record is not compliant; or
directing a device making the request to a non-production instance of the target application.
13 . The method of claim 10 , wherein the identity information corresponds to a user, wherein the authorization information includes group membership for the user in a first group, and the approval record comprises a ticketed event by which the user was added to the first group.
14 . The method of claim 13 , wherein determining whether the approval record associated with the authorization information satisfies the compliance program comprises:
determining an expiration time for the approval record based on the compliance program; and
determining whether the approval record has expired for the compliance program.
15 . The method of claim 14 , further comprising:
determining that the target application is also subject to a second compliance program;
determining a second expiration time for the approval record based on the second compliance program; and
determining whether the approval record has expired for the second compliance program.
16 . The method of claim 10 , further comprising:
receiving a registration request for the target application, including an indication of the compliance program; and
storing an association between the target application and the compliance program.
17 . The method of claim 10 , further comprising:
receiving a compliance program profile for the compliance program; and
storing an association between the compliance program profile and the target application.
18 . The method of claim 10 , wherein the request for the authorization token is received from a first application, separate from the target application, to use an application programming interface (API) function of the target application.